{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/subscriptions-for-woocommerce-2.0.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-15414"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Subscriptions for WooCommerce (2.0.0)"],"_cs_severities":["high"],"_cs_tags":["wordpress","privilege-escalation","web-application","cve-2026-15414"],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe Subscriptions for WooCommerce plugin for WordPress (versions 2.0.0 and earlier) contains a critical privilege escalation vulnerability (CVE-2026-15414). The flaw resides in the \u003ccode\u003esave_meta_boxes()\u003c/code\u003e function, which incorrectly handles the \u003ccode\u003e_wps_plan_user_role\u003c/code\u003e meta field during membership plan creation. The plugin relies on client-side \u003ccode\u003edisabled\u003c/code\u003e attributes in the UI to prevent the selection of privileged roles, a control that is trivially bypassed. Furthermore, the backend validation uses \u003ccode\u003esanitize_key()\u003c/code\u003e and \u003ccode\u003ewp_roles()-\u0026gt;is_role()\u003c/code\u003e, both of which permit the 'administrator' role. Because the \u003ccode\u003ewps_membership_plan\u003c/code\u003e post type uses standard post capabilities, any user with permission to edit posts (Contributor or higher) can trigger the \u003ccode\u003esave_meta_boxes()\u003c/code\u003e function. If the Pro companion plugin is active, it processes the injected 'administrator' value in \u003ccode\u003e_wps_plan_user_role\u003c/code\u003e and promotes the attacker via \u003ccode\u003eadd_role()\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates as a user with Contributor-level access or higher.\u003c/li\u003e\n\u003cli\u003eAttacker initiates an HTTP POST request to modify or create a \u003ccode\u003ewps_membership_plan\u003c/code\u003e post.\u003c/li\u003e\n\u003cli\u003eAttacker bypasses the UI's \u003ccode\u003edisabled\u003c/code\u003e attribute by intercepting the request or using browser DevTools.\u003c/li\u003e\n\u003cli\u003eAttacker injects the \u003ccode\u003eadministrator\u003c/code\u003e value into the \u003ccode\u003e_wps_plan_user_role\u003c/code\u003e meta field within the POST body.\u003c/li\u003e\n\u003cli\u003eThe plugin's \u003ccode\u003esave_meta_boxes()\u003c/code\u003e function executes, validating the input with insufficient checks that allow the 'administrator' string.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003e_wps_plan_user_role\u003c/code\u003e meta is persisted to the database for the membership plan.\u003c/li\u003e\n\u003cli\u003eThe Pro companion plugin monitors membership lifecycle events and reads the malicious meta via \u003ccode\u003eget_post_meta()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe Pro plugin executes \u003ccode\u003eadd_role()\u003c/code\u003e using the attacker-supplied value, promoting the user to Administrator.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full administrative control over the WordPress instance. This vulnerability affects all installations using Subscriptions for WooCommerce 2.0.0 or lower where the Pro companion plugin is also installed. An attacker gaining administrative access can execute arbitrary code, modify site content, exfiltrate user data, or deploy persistent backdoors within the WordPress environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for detection and mitigation:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Subscriptions for WooCommerce plugin to the latest version once a patch is available.\u003c/li\u003e\n\u003cli\u003eAudit existing membership plans for any \u003ccode\u003e_wps_plan_user_role\u003c/code\u003e meta values set to 'administrator' or other unauthorized roles.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for suspicious POST requests targeting \u003ccode\u003ewps_membership_plan\u003c/code\u003e post updates that contain unexpected role parameters.\u003c/li\u003e\n\u003cli\u003eReview all user accounts with Administrator privileges for suspicious recent activity or unauthorized creation.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-01T03:48:30Z","date_published":"2026-08-01T03:48:30Z","id":"https://feed.craftedsignal.io/briefs/2026-08-woocommerce-priv-esc/","summary":"The Subscriptions for WooCommerce plugin for WordPress is susceptible to privilege escalation allowing authenticated users with Contributor access to promote themselves to Administrator via insecure meta box handling.","title":"Privilege Escalation in Subscriptions for WooCommerce Plugin","url":"https://feed.craftedsignal.io/briefs/2026-08-woocommerce-priv-esc/"}],"language":"en","title":"CraftedSignal Threat Feed - Subscriptions for WooCommerce (2.0.0)","version":"https://jsonfeed.org/version/1.1"}